<html>
<head><meta charset="utf-8"><title>Missed opportunity? · edition 2021 · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/index.html">edition 2021</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html">Missed opportunity?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="244116862"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244116862" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244116862">(Jun 28 2021 at 08:48)</a>:</h4>
<p>I'm wondering if we missed an opportunity to make progress on <a href="https://github.com/rust-lang/rust/issues/71668">unsafe blocks in unsafe functions</a> by requiring the use of unsafe blocks in unsafe functions.  I guess it's too late, but I thought it worth bringing up.</p>



<a name="244120669"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244120669" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mara <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244120669">(Jun 28 2021 at 09:31)</a>:</h4>
<p>i think we discussed it at some point, quite early on. i think the conclusion was that it'd cause too much churn and would be hard to automatically migrate other than by wrapping <code>unsafe { .. }</code> around entire function bodies</p>



<a name="244121013"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244121013" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244121013">(Jun 28 2021 at 09:35)</a>:</h4>
<p>I don't remember discussing it, but I'll take your word on it. That argument sounds like we'll _never_ make the change then though. Was that the conclusion reached?</p>



<a name="244121494"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244121494" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mara <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244121494">(Jun 28 2021 at 09:40)</a>:</h4>
<p>maybe it was some informal discussion i had somewhere before we even started having meetings. not sure.</p>



<a name="244122042"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244122042" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244122042">(Jun 28 2021 at 09:46)</a>:</h4>
<p>Oh well <span aria-label="frown" class="emoji emoji-1f641" role="img" title="frown">:frown:</span> I'd really love to see that change happen as I think it makes unsafe code much easier to audit, but we can revisit this the next go around <span aria-label="blush" class="emoji emoji-1f60a" role="img" title="blush">:blush:</span></p>



<a name="244123583"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244123583" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mara <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244123583">(Jun 28 2021 at 10:02)</a>:</h4>
<p>so how would the migration work?</p>



<a name="244125221"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244125221" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244125221">(Jun 28 2021 at 10:23)</a>:</h4>
<p>I personally don't see an issue with wrapping <code>unsafe</code> functions in a massive unsafe block.</p>



<a name="244127554"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244127554" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mara <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244127554">(Jun 28 2021 at 10:53)</a>:</h4>
<p>hm, okay. yeah maybe that wouldn't be that bad</p>



<a name="244127594"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244127594" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mara <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244127594">(Jun 28 2021 at 10:53)</a>:</h4>
<p>i haven't seen many people use the feature yet. possibly because they don't know about it.</p>



<a name="244130173"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244130173" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244130173">(Jun 28 2021 at 11:21)</a>:</h4>
<p>I didn't know about the feature until today. I only knew about the RFC. (Or I knew and I forgot).</p>



<a name="244136948"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244136948" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244136948">(Jun 28 2021 at 12:32)</a>:</h4>
<p>I use this feature all the time, but I only know about it because libstd uses it (if I'm thinking of the right feature)</p>



<a name="244149241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244149241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244149241">(Jun 28 2021 at 14:05)</a>:</h4>
<p>I know about the feature and absolutely <em>would not</em> use it in at least one of my crates, but generally <em>would</em> use it the rest of the time. As a person who writes a whole lot of unsafe code, I was certainly initially wary. However, I've come around to it, and as long as it stays a Deny By Default lint that you can always turn off (in not just 2021 but in all future editions) then it's a good update for the language.</p>



<a name="244154864"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244154864" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244154864">(Jun 28 2021 at 14:41)</a>:</h4>
<p><span class="user-mention" data-user-id="224872">@rylev</span> we did discuss it; I don't think we missed much of an opportunity, I think we can easily move to "warn by default" if we want to nudge people</p>



<a name="244154932"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244154932" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244154932">(Jun 28 2021 at 14:41)</a>:</h4>
<p>I think the short version was that we were not in a position to make this a hard error yet</p>



<a name="244154945"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244154945" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244154945">(Jun 28 2021 at 14:41)</a>:</h4>
<p>I still believe it's the right direction, though</p>



<a name="244155005"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244155005" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244155005">(Jun 28 2021 at 14:42)</a>:</h4>
<p>but I'd probably like to <em>really</em> make the change along with some other changes, such as a <code>trusted</code> keyword</p>



<a name="244155468"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244155468" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244155468">(Jun 28 2021 at 14:45)</a>:</h4>
<p>Never mind the noise then <span aria-label="blush" class="emoji emoji-1f60a" role="img" title="blush">:blush:</span> We can discuss this again at some later point</p>



<a name="244168323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244168323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244168323">(Jun 28 2021 at 16:10)</a>:</h4>
<p><span class="user-mention silent" data-user-id="116009">nikomatsakis</span> <a href="#narrow/stream/268952-edition-2021/topic/Missed.20opportunity.3F/near/244154932">said</a>:</p>
<blockquote>
<p>I think the short version was that we were not in a position to make this a hard error yet</p>
</blockquote>
<p>please not ever a hard error. if a person really has that much unsafe code then it really just adds noise to the file.</p>



<a name="244168359"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244168359" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244168359">(Jun 28 2021 at 16:10)</a>:</h4>
<p>My personal stance on it: make it a deny-by-default at some point, <code>unsafe fn</code>s disabling the requirement for <code>unsafe</code> inside the body is still a weird oversight from the language, which leads to error-prone code. For cases such as <span class="user-mention" data-user-id="224471">@Lokathor</span>'s, they would have to add a <code>#![allow(unsafe_op_in_unsafe_fn)]</code> at the root of their crate to opt-in back into the "legacy" mode, which I do believe is reasonable (but I do agree that making it a hard error does more harm than good compared to a deny-by-default lint; especially since those wanting it to be a hard error can already <code>#![forbid(…)]</code> it).</p>



<a name="244238430"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244238430" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244238430">(Jun 29 2021 at 06:33)</a>:</h4>
<p><span class="user-mention silent" data-user-id="116009">nikomatsakis</span> <a href="#narrow/stream/268952-edition-2021/topic/Missed.20opportunity.3F/near/244154932">said</a>:</p>
<blockquote>
<p>I think the short version was that we were not in a position to make this a hard error yet</p>
</blockquote>
<p>I'm personally in the "not yet convinced it should ever be a hard error" camp.</p>
<p>Maybe deny-by-default, but I think that letting it be allowed in a module where you're basically writing C code and don't want the extra block seems reasonable.</p>



<a name="244239272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244239272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> inquisitivecrystal <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244239272">(Jun 29 2021 at 06:47)</a>:</h4>
<p>I think that not making it a hard error may not fully meet the goals of getting rid of it? Part of the question here is what the semantics of an unsafe fn are. This is trying to move them from "is unsafe to call and has an unsafe interior" to "is unsafe to call".  Allowing someone to override the lint means that people have to carry around that extra mental rule, rather than being able to make a clear distinction between the two. From this perpective, it might be better to add an attribute for "everything in this context is implicitly unsafe", because at least that would be a clear seperation between the two. I'll also point out that if the module is basically C code, that still doesn't explain why <code>unsafe fn</code> functions should be treated differently from any <em>safe</em> C code functions you may have.</p>



<a name="244239532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244239532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> inquisitivecrystal <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244239532">(Jun 29 2021 at 06:51)</a>:</h4>
<p>To be clear, the idea of adding a new attribute was by way of example. I know that would be an entirely different discussion.</p>



<a name="244239715"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244239715" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> inquisitivecrystal <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244239715">(Jun 29 2021 at 06:53)</a>:</h4>
<p>It's also true that even without making it a hard error, the other goal of removing it, which is safer code, can still be met.</p>



<a name="244270889"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244270889" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244270889">(Jun 29 2021 at 12:18)</a>:</h4>
<p>I don't think we should make things hard errors because we don't like a style of code. The <em>only</em> case when things should be errors are:</p>
<ul>
<li>across editions, because then it's opt in, and we have a strong reason to reuse that syntax in the future</li>
<li>when the feature is unsound and cannot be made sound</li>
</ul>
<p>Even <code>mem::uninitialized</code> hasn't been removed and it's completely impossible to use soundly.</p>
<blockquote>
<p>Allowing someone to override the lint means people have to carry around that extra mental rule</p>
</blockquote>
<p>Making it a hard error <strong>takes their choice away</strong>! There is enough trouble with Rust saying it is backwards compatible and breaking things because they aren't covered by the policy without breaking random things because we wish we'd made different decisions 5 years ago.</p>



<a name="244271330"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/268952-edition%202021/topic/Missed%20opportunity%3F/near/244271330" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/268952-edition-2021/topic/Missed.20opportunity.3F.html#244271330">(Jun 29 2021 at 12:23)</a>:</h4>
<p>Imagine if we were having this conversation about the 2015 module system. It's a much different system than 2018, so definitely you need extra mental rules to understand it. However, breaking it completely means <em>many crates stop compiling in new Rust versions</em> - that's bad enough now, imagine it in 2018 when the edition first came out. It would have been another python 2/3 fiasco</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>